Why I lost $42,500 making a VR game - <AUTHOR> http://www.gamasutra.com/blogs/JosephRadak/20181128/331531/Why_I_lost_42500_making_a_VR_game.php <comment><USER2> Check out the reviews of the game.

[https://store.steampowered.com/app/528930/Fruit_for_the_Vill...](https://store.steampowered.com/app/528930/Fruit_for_the_Village/)

There are three reviews and they are all negative. Maybe the only reason he didn't make money is it's just not a good game.

<comment><USER3> It's a narrative game at that. They're incredibly niche even when they're not VR games.

<comment><USER4> No offense, but "it's a narrative game" seems to have become the new excuse for games that lack any interesting gameplay or actual content and thus have to play up the "artistic angle" by pretending to tell some amazing story.

Looking at the Steam page for this its genre is listed as a clicker, a review points out there's literally no progression for the clicker gameplay part, that's a bad clicker right there because those are usually all about the progression.

You can't make an oversight like that up with narrative, if the gameplay is driving away the player then you can have the most amazing narrative in the world, most people still won't experience it because they won't get past the bad gameplay.

<comment><USER5> There are a lot of great narrative games:

\- Firewatch

\- Life is Strange

\- Tacoma

\- Gone Home

\- Oxenfree

\- What Remains of Edith Finch

It's probably my favorite indie genre and when done well it's a lot different than anything else out there.

<comment><USER6> For anyone who cares about this genre, I'll throw in strong recommendations for

\- The Vanishing of Ethan Carter

\- Virginia

\- SOMA with the monster interactions turned off (they don't bother me, but with interactions it's not strictly a narrative game)

and moderate recommendations for

\- Dear Esther

\- Ether One

\- Everybody's Gone to the Rapture

<comment><USER7> "The beginners guide" is another good one.

</comment></comment></comment></comment></comment></comment><comment><USER8> This is pretty poor analysis on his part about why the game wasn't successful and what it means for the state of the VR market. From a talk at the Game Developer's Conference last March it was shown that the average Steam game makes about $30k in it's first year. That's non-VR.

According to the Steam hardware survey, about 1% of users own a VR headset. This paints a pretty grim picture about what an average VR game can expect to make on Steam.

However that's what you could expect an average game to make. You make exponentially more money the more standard deviations you are from the average.

A few things that push you in the direction of success: an obvious and interesting hook, a compelling trailer, some basic marketing, and quite obviously fun mechanics. I have not played his game, but I can tell from a glance that it is missing the majority of those requirements.

It may be survivorship bias, but I can back this up with experience. I made a good-but-not-great VR game that hit all those major success points, and combined the PC and PS4 have grossed us mid-six figures.

<comment><USER9> > and combined the PC and PS4 have grossed us mid-six figures.

Which platform brought in more sales?

<comment><USER8> Can't share exact numbers due to NDAs, but it's pretty even.

</comment></comment></comment><comment><USER10> The story is informative -- VR games don't sell well, except if you can time to new hardware -- but the math behind the $42.5k number is dubious.

Can I value all my hobby projects at $60/hour too? Over a million USD accumulated losses during my adult life so far...

<comment><USER11> I'd be happy with $60/hr for my day job.

<comment><USER12> Currently making $17/hr pre-tax and it is liveable in my suburban area. With overtime which is generously available at 1.5x pay, I could afford to raise a family even, and this job feels much more stable than other tech industry jobs I've had in the past.

I currently work for Star Gas, which is a northeastern USA based company that delivers heating oil to over 600,000 customers with revenue of about 1B per year (but razor thin profit margins of about 55m per year).

<comment><USER13> What is the cost of living? That seems rough almost anywhere to support a family. What do you do?

<comment><USER12> I started out in customer service making that rate, and I've also done sales and billing adjustments at the company for the same rate of pay. Those roles are more like "internally advertised", whereas customer service is externally advertised because of the high need for these roles and the relatively high turn-over rate in the position because of the type of work (shouting customers who are angry about price or tardiness of service lol).

My half of the rent and utilities is currently $1000 a month. A car payment, phone payment, insurances of various kinds and some food and entertainment spending cap out at about another grand per month, so $2000 total. With no overtime and after taxes, you start out at about $2200 a month in post tax, very reliable income. If you are willing to do 10-12 hour days, you can pull in about $4000 a month with no college degree and, to my experience, no crazy office politics or externalities.

It might not be enough to support a stay at home spouse, 2 kids, 2 range rovers, a large mortgage, vacations and shopping, and a robust family medical insurance plan, but it is definitely enough for a normal apartment in a normal suburb, driving an older vehicle and enjoying some westernized habits like eating at a restaurant or doing lots of christmas shopping :)

Thanks for asking, because I actually left tech sales completely for this field instead and I am pretty happy with the forced change of industry so far (oracle laid me off!!!)

<comment><USER14> Thank you for sharing these details! I value the insight into how diverse the "making ends meet" dimension can be, even among people connected to tech in some way.

<comment><USER12> Thanks for asking, it was a pleasure :)

I've lived off of less than $300 in Thailand and Chile before, but that's basically enough to afford only food and a room... and in my case in Chile, food and a tent in the mountains!!

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> I'm not sure if a clicker game is a good choice for VR. Playing VR takes a fair bit more effort than "open the game" and is hence better suited for deeply engaged titles (something that you are concentrating on and plan to play for more than a few minutes). Clicker games are time-wasters (you're waiting for the compiler or similar and have a few minutes). They are disengaged titles.

<comment><USER16> This was my thought as well. I usually buy games from HN to support people trying things, but the idea of spending uncomfortable time in the headset for an idle game just puts me off. If I'm going to play an idle game, it'll be while the tv is on and I'm in comfy clothes or in bed.

</comment></comment><comment><USER17> I lost $10 reading this post.

<comment><USER18> Earned $5 laughing at this comment.

</comment></comment><comment><USER19> Presumably, there are interesting skills and experiences obtained from this project which can be applied to future projects or leveraged for a better / higher-paid day job. If the time investment is being valued at $60/hr, it's only fair to perform a valuation on the incremental training as well. This seems like a case where the numbers are easily skewed in either direction to fit a desired narrative.

Still, I acknowledge that it's very hard to spend a year of your life on something and only end up with $700 in-pocket.

</comment><comment><USER20> The biggest concern I have is that he justifies it based on the idea that "he was pushing boundaries"... but really, he wasn't: just because something doesn't exist doesn't mean it should (or would be interesting if it did), and at least from his description, it doesn't seem like he made any real use of the vr medium. He just... wrote a pc game(?) and slapped a vr interface on top.

Vr chat pushes boundaries. It plays with the medium in a fashion that is _only_ available to that medium. A VR computing environment would be pushing boundaries. A VR mirrors edge might be pushing boundaries (kinda; its more like mirrors edge was a game that imagined what vr would be like, and executed that vision under pc constraints. Now that vr is actually available, transferring over would be the obvious thing to do). A vr god game might push boundaries, if they do it right.

But cookie cutters and VN's? I don't see how you'd get anything out of vr in a straightforward port. By the time you actually got the medium doing something useful, it'd probably look nothing like an "incremental narrative game"

</comment><comment><USER21> Seems like an article that was written to get purchases from people that like supporting this kind of indie development--pity sales. Which, honestly, I wouldn't mind, except that the article itself is pretty bare of any actual content. The cash figure is made up, the game itself is apparently awful, and the information in the article doesn't support the conclusion(s).

</comment><comment><USER22> VR goggles are dead.[1] At least for this generation.

[1] [https://www.digitaltrends.com/computing/proof-vr-sales- numbe...](https://www.digitaltrends.com/computing/proof-vr-sales-numbers- sinking/)

<comment><USER23> A buddy of mine sunk about ~$2,000 into VR just as a casual gamer and not is not including the cost of a PC. He bought Oculas at launch, bought the controllers at their launch and bought many other accessories for driving and flight VR games. I initially thought VR was a fad but was still skeptical of its success. At this point I believe my skepticism is over. He and my other friends that bought headsets never use them anymore, it's been a year since they have played. They still defend their purchases, to them they say they got their moneys worth out of playing.

EDIT: One other thing I forgot to mention. Having the space to play and dealing with the wires is a huge frustration I saw my friends deal with. Every time they wanted to play they had to spend over an hour setting it up to just play for an hour or 2. That is unless you had a dedicated space for it. I hope no one wants their living room cluttered with wires going across the floor and VR accessories laying around.

<comment><USER22> It's frustrating. The experience is fun for 20 minutes or so, but it's downhill from there. I've used both the HTC Vibe and the Microsoft HoloLens, and enjoyed them. I've tried VR headsets all the way back to Jaron Lainer's original prototype. But I wouldn't spend two hours wearing any of this stuff. This seems to be the general opinion of people who can tolerate the things.

About 25-40% of the population becomes nauseated [1], which is a problem for a consumer product. That's higher than roller coasters. VR is just not going to be the Next Big Thing. Simple overlays in AR, maybe.

[1] [https://www.sciencenews.org/article/virtual-reality-has- moti...](https://www.sciencenews.org/article/virtual-reality-has-motion- sickness-problem)

<comment><USER23> I would definitely fall into that percentage. That mixed with myopia was a definite no-go for me, trying to wear the headset with glasses was too much of a hassle for me. If I didn't wear glasses the screen would be blurry and I would start to get a migraine after 30 minutes of playing. I am still interested in what AR has to offer.

</comment></comment></comment></comment><comment><USER24> Honestly just sounds like a boring game. Wouldn't have been fun without VR, so immersion isn't going to be some kind of magic bullet. The steam page does it no favors; I couldn't find any examples of gameplay, and both videos show the same general content. I suspect no one bought it because, well, there was no reason to buy it.

</comment><comment><USER25> Kind of pretty much clickbait, since no real money was expended across bank accounts between two or more separate parties.

The author expounds on an appraisal of hypothetical money, if one imagine's that he paid himself all labor costs to perform the work.

He spent several months working on a video game that didn't do well, and made zero dollars.

Did I lose $6,000 dollars on a hypothetical bitcoin I never paid for in August, when the value dropped last week?

No, I left the $10,000 dollars in my bank account, and I still have $10,000, and/or whatever real goods or services I purchased with said money.

<comment><USER26> Makes me vomit in my mouth when I read this sort of self-sufficient "I payed myself $60 / hour". You know what? An amount can only be quoted if you're PAYING someone else, it's only then when it stings.

These sort of entitled-clueless individuals wouldn't pay $6 / hour for an UpWork contractor to make a game 10x better than their crap.

<comment><USER27> For accounting purposes he likely did actually pay himself the money, transferring it from the company to himself, and adding the perceived value of the game to tho company, which can write off the loss going forwards.

<comment><USER26> Where I live (EU), if I pay myself "for accounting purposes" $60 / hour, then I own the state $24 / hour in taxes. Did he actually pay =~ $20,000 in taxes? If so, respect, he did pay himself $60 / hour. But I bet a castle that he "payed himself" $60 / hour just like I pay myself a castle per hour when I do side work. (Which is also why I so nonchalantly can afford to bet one :P)

<comment><USER28> AIUI you can keep the wages in arrears, in UK tax is due when you actually receive the money.

This is sensible: otherwise you might owe taxes if your employer company collapsed and you weren't paid, but without having income to pay it.

</comment></comment></comment></comment></comment><comment><USER29> that's not $42,500, that's 820 hours

<comment><USER30> Another thing that's crazy is that writers, artists, 3d model animators, and voice actors[1] never make $60 an hour doing this kind of work, and yet he lumped those things under "developer time" high-level wages.

[1](Unless they're famous people for their particular talent category)

<comment><USER31> Union voice actors make hundreds of dollars per hour typically (a standard good but not-very-famous video game voice actor makes 2x scale).

</comment></comment></comment><comment><USER32> Nothing really to do with VR itself. If anything VR is more favorable for an indie developer as there are less titles on the stores and a more fervent / willing base of users (for desktop VR users), and more room to be creative with interactions versus leaning on visuals.

But making money from indie games is tough in general, it takes a long time, execution is difficult, and marketing is needed. Can even apply to just general making money from app stores or software. Need to have a good idea, execute, market, and stand out from the rest. App stores though give you some boost in discoverability.

</comment><comment><USER33> So he actually lost nothing, apart from a bunch of free time, making a shitty game that no one wants, then blames others for him not making money at the rate he thinks he deserves. I've seen better looking atmospheric games made in game jams...

</comment><comment><USER34> "Platform holders need to make it easier for VR game developers to get their games onto their platforms and reach the people who want the game they're making. This goes beyond just financial, this goes towards publicity, mentorship and more."

This point needs to be fleshed out more. What is say the Oculus App store _not_ doing that the iOS app store is? As a _user_ (not a developer) of both, I'm not seeing a difference.

<comment><USER35> It doersn't really - The poster made a crappy game, didn't market it, didn't test it, and seems to blame others.

There are 3 reviews, all negative, with show stopping bugs even 6 months after they first reviewed it. Poster says he didn't market it until 6 weeks before release. This is just shovelware, unfortunately

<comment><AUTHOR> Yes, in this case there isn't much more platform holders can do, even if they feature his game on the front page indefinitely it will get flooded with negative reviews and sales will be low. You can't compare VR platforms with iOS especially, but even Steam or a console market, because the number of users is orders of magnitude smaller (250K-1 million VR users per platform). In this case the best a platform holder can do is fund development so he can potentially make a better game (hire a programmer and an artist for example), but it doesn't seem like a situation where the concept was amazing and he failed on execution.

</comment></comment></comment><comment><USER36> Read the stories of also-rans from any medium and you'll find the same: lots of 'reasons'. We live in a winner-take-all world. Being truly innovative and enjoying the rewards that come along with it are exceptionally rare, and most certainly succeed by filling a need that isn't met. I haven't messed with VR since Oculus DK2's were brand new, but I'm certain the amount of vaporware. What I Need is an outsized, impossible experience that justifies the medium and my expensive purchase of tiny face monitors. The very idea of a clicker on a medium that involves physical pain if I play it too long sounds like the last thing I need. Kudos for trying though, its more than I have done.

</comment><comment><USER37> He earned $60 per hour and billed (himself) 820 hours. Title should be changed to "How I earned $42,500 making a bad VR game". And he should tax it.

</comment><comment><USER38> It cost 43,200 to make and it sold 42,500 net, that's ok if he did it himself, for a first effort, nicely done.

<comment><USER27> It didn't sell 42,500 net. He writes that his net profit was -42,500. Note the minus in front. He sold ~100 copies.

</comment></comment><comment><USER39> I lost $50k making a VR game show. That was fun!

</comment><comment><USER40> Notch was only in it for the money! Not!

</comment><comment><USER41> phrasing it as losing money this way is dishonest attention seeking.

If a friend told me a group lost $10k making a game over the weekend, i'd freak out

<comment><USER27> It is a business loss. And if the business paid this though borrowed money it could end up going bankrupt, yet he'd still have the 42k$ that his company paid him.</comment></comment>


Why Coders Shouldn't Join a Start-up When They Graduate - <AUTHOR> http://www.technologywoman.com/2011/10/29/why-coders-shouldnt-join-a-start-up-when-they-graduate/

<comment><USER2> My comment that I posted on the site:

I don't disagree that having a big name on resume can be helpful. But I do think there are other things that should come into consideration.

I worked at several no name startups right out of college. And yes they failed, but I was also given huge opportunities and responsibilities that I _never_ would have had at a larger firm.

And as a hiring manager I don't let names on resumes be my only driver. Just because you worked at Amazon straight out of college doesn't mean you are amazing. It just means they gave you a chance. And it doesn't mean you've done much, you may have just been stuck fixing bugs on one very small aspect of one system. That isn't very valuable in my eyes.

So I think it's worthwhile noting that there is a risk at startups and the name recognition is definitely useful in a crowded market. But name recognition will only get your foot in the door. You'll need some real experience to go the rest of the way, and I have nothing but my years at failed startup to thank for that.

</comment><comment><AUTHOR> I think if you want to join a startup, the best time would be really straight after college. At that point in time you usually will find individuals who are motivated, fresh, and very well driven, which are very important in startups. Big company names in resumes are never bad, but there are many other ways to compensate that in life (side-projects, brilliant hacks, contribution to open source projects). I guess it's just a matter of choice/preference, but it's never wrong to go one over the other. If you want to have a safe/no risk life, go with the large companies.. if you want to take some risk, add more flavors to your life, startup is the way to go. No one is born the same way, so either way is perfectly acceptable. I just feel like the author emphasizes that if you join a startup straight after you graduate then you're doomed for the rest of your life, which absolutely is not true.</comment>


Earth's aliens - <AUTHOR> http://aeon.co/magazine/science/does-earth-have-a-shadow-biosphere/ <comment><USER2> > If a shadow biosphere were ever found...

...it would automatically become part of the biosphere. Note that an entire _kingdom_ of life, the Archaea, was only identified in 1977[1]. That was a "shadow biosphere" if you like: an entire separate version of life, unidentified as such until we could sequence RNA. But at least some species of Archaea were known long before, just inadequately classified.

N.B. "Desert Varnish" is not at all the mystery the article suggests[2] and the idea that it represents some kind of biology seems extremely improbable: "Microscopic and microchemical observations, however, show that a major part of varnish is clay, which could only arrive by wind.[5] Clay, then, acts as a substrate to catch additional substances that chemically react together when the rock reaches high temperatures in the desert sun. Wetting by dew is also important in the process.[3]"

[1] [https://en.wikipedia.org/wiki/Archaea](https://en.wikipedia.org/wiki/Archaea) [2][https://en.wikipedia.org/wiki/Archaea](https://en.wikipedia.org/wiki/Archaea)

</comment><comment><USER3> Interesting and fun article to read. I'm with Disqus commenter, Michael Hanlon, in finding it strange that the two don't co-exist to some degree. We should've found evidence of it already given all the tools we use on stuff we analyze. I doubt it exists for now. As I told him, the biological mechanisms we see in use might be as fundamental as the reasons that most objects in the universe are stars burning hydrogen. Might just be a constraint in how things are formed given universe's rules. Or not and we discover a shadow biosphere if we're lucky. :)

Far as a different code, I remember reading an article somewhere on an inventor that created a bulk genetic engineering process. It iterates whole sets of modified organisms with tons of different mods until the desired effect (eg production of a chemical) is detected. Then it tries to isolate the modification that achieved that and test its reliability for future, precision work. In response to safety concerns, the article reported that they were thinking about creating an artificial DNA-alternative for their process to keep it from producing out of control creations. I had doubts on their ability to do that or its ability to work lol.

Anyone remember that article or know where that tech went? Closest thing to shadow biosphere concept I've seen in my news feed albeit artificial.

</comment><comment><USER4> I was just discussing a similar idea with a friend this weekend. Perhaps abiogenesis could _still_ be occurring on earth. My friend contended that existing life would consume the raw ingredients before they could self assemble. It's a very reasonable objection but I think it's an assumption worth checking.

I'd never heard of desert varnish, that's totally fascinating.

</comment><comment><USER3> An interesting concept I found while looking up the Desert Varnish, which already has better explanations.

[https://en.wikipedia.org/wiki/Biological_dark_matter](https://en.wikipedia.org/wiki/Biological_dark_matter)

</comment><comment><USER5> The first paragraph really turned me off. Author is throwing wacky statements out hard and fast. Eg. apocryphal Newton apple dropping reference + saying scientists are looking for evidence of life "scittering" on Mars

</comment><comment><USER6> Woot. Yay. Mind bending. In the extreme.

So, on our way out, maybe we can toast this possibility. A beer with cancer or old age, on the possibility there might be alien microbes on earth.

Sarcasm, yes. Lack of imagination -- I clicked on this thinking I would find relevant expressions of daunting imagination. But, instead, unfortunately... when I enter this into my equation of (You are going to die + X = ?), unfortunately this remains zero'd out as entirely irrelevant.

It is almost as if the whole "you are going to die" factor in my equation is the equivalent to zero. And everything else is zeroed out. Except for those dare, rare - often very mad, surely, or genius - sons of bitches that do not actually ___like_ __being zero 'd out and actually expect not to be.

Well. Fuck them. Do not even try.

</comment><comment><USER7> Didn't read it yet, but I love the title.

TBC</comment>


Your Princess Is in Another Castle: Misogyny, Entitlement, and Nerds - <AUTHOR> http://www.thedailybeast.com/articles/2014/05/27/your-princess-is-in-another-castle-misogyny-entitlement-and-nerds.html

<comment><USER2> > Other people's bodies and other people's love are not something that can be > taken nor even something that can be earned—they can be given freely, by > choice, or not.

This

</comment><comment><USER3> > We need to get that. Really, really grok that, if our half of the species > ever going to be worth a damn.

I'll see you at the next male re-education meeting, then.</comment>


Show HN: ThinkCool – Make Better Decisions - <AUTHOR> https://www.producthunt.com/posts/thinkcool <comment><USER2> Hey there, there is fundamental mistake on rating of nightlife on Phi Phi island [0] - only two stars. Should be five stars or so.

[0] [https://www.youtube.com/watch?v=55o3q1btq-U](https://www.youtube.com/watch?v=55o3q1btq-U)

All the best with launch

<comment><AUTHOR> Haha thanks, been almost 10 years since I was last there. This is why you want to share your evaluations to get feedback from others :)</comment></comment>


Recommendations for building a career in open source - <AUTHOR> https://opensource.com/business/16/8/building-career-open-source <comment><USER3> Open source is not a good career path. It's hard. Bastard hard. It took me 5 years of running open source projects before one of my projects got popular.

What did I get from this? It gave me the flexibility to work for any company I want. It allowed me to meet some big startup founders.

That sounds great but I probably spent 4000 hours over 5 years on open source. If I had used that time to do extra contract work on the side, I could easily have earned $300k. I could have used the money to buy a house. Instead I have very little savings.

Open source is not worth it as a career. Only do it if you love it. Don't expect it to pay. Your project can have thousands of stars on GitHub and have thousands of users but it doesn't translate to much. The average Facebook or Google employee probably gets about the same amount and quality of career opportunities as I do... If not better. But they have savings, they own Facebook stock.

Career wise there is no doubt that open source is a mistake. And I'm actually one of the lucky ones... Most open source projects never get popular enough have any community around it at all.

Like the author said, it's all about networking. Don't bother writing code... Just blog about other people's open source work and meet people and you will succeed.

<comment><USER3> If you want to get an idea for how difficult a career choice open source is:

I'm currently working to monetize my open source project with [https://baasil.io/](https://baasil.io/) (with some cofounders) - <USER2> surprising thing I learned is that investors do NOT care AT ALL that your OSS project has almost 20k downloads per month and that you spent 3+ years of your life on it and are fully dedicated to it. Employers care, other developers care, but to an investor, it means nothing.

I applied to a startup incubator in Sydney several months ago; I showed them all my project stats (it's probably one of the most popular open source frameworks to come out of Australia). I hussled hard; I even managed to get tickets to a few investor conferences and events and, each time, I would talk to every person in the room. I ended up securing a coffee meeting with an investor (after talking to him at two different events; 3 if you count the fact that I had actually talked to the guy on the phone 2 years before about what I was planning to do; so he knew I was serious) and he recommended that I apply to an incubator in which he was a director.

I applied; but I didn't even end up getting into the first round of interviews (they just didn't understand the product or the market)! They selected a bunch of other startups (some of which didn't even have a proof of concept to show).

Maybe the experience would have been different in another country.

<comment><USER4> I like the honesty of your answers.

I think an investor would care more if it were making money, or if there was a way to make money. I think charging is a great way to demonstrate that.

You could also just add a voluntary payment and see if people just send some money your way.

</comment></comment></comment><comment><USER5> Realistically if you want to be paid to work on open source, work for Oracle, IBM, Red Hat et al

<comment><USER6> True, but it probably reduces the range of products you can work on ;-)

<comment><USER7> That's not really true for SUSE (I work there), and I doubt it's true for RedHat and similar companies. As long as it doesn't impact your L3 bug squashing abilities, and it is at least tangentially related to what your team focuses on then there's no problem.

</comment></comment></comment><comment><USER8> Some more great advice on negotiation of employment contracts for open source jobs:

[https://lwn.net/Articles/688451/](https://lwn.net/Articles/688451/)

</comment><comment><USER9> You build a career doing a job and solving problems, using specific skill sets.

Sometimes you're lucky enough to get paid to work on opensource projects or projects you've worked on become opensource.

I've built a career on open source technologies, mainly as a hobby that I turned into a job :)

</comment><comment><USER10> It seems to me that you need to be a good writer and be an interesting speaker at conferences. Just writing open source code is probably not a good career path. At least if you want to make some money.

</comment><comment><USER11> Nice article from the best community expert out there.

I think the natural trajectory for a developer can be something like:

1\. Work on it as a hobby

2\. Hobby gets a bit too serious

3\. Start charging an hourly fee

4\. Get hired by company sponsor or start company</comment>


TLS verification vulnerability in LibreSSL 2.5.1-2.5.3 - <AUTHOR> http://seclists.org/oss-sec/2017/q2/145 <comment><USER2> Here's the referenced commit for the interested: [https://github.com/libressl- portable/openbsd/commit/ddd98f8e...](https://github.com/libressl- portable/openbsd/commit/ddd98f8ea741a122952185a36c1396c14c2fda74#diff-027facc0b7c35aa46b0e8fa7b467f1c4)

To be honest I'm kinda surprised that even after the 'goto fail' story people still write code in this questionable style(I know this particular issue is not stemming from the lack of curly braces, but still).

<comment><USER3> _surprised that even after the 'goto fail' story people still write code in this questionable style_

LibreSSL didn't spring into existence out of whole cloth. It started as a fork of OpenSSL, which goes back to 1998.

The "questionable style" is from legacy code. It would be a massive effort to revise the entire codebase. And if LibreSSL did that, it would make it harder to import changes from OpenSSL and from other forks such as BoringSSL.

<comment><USER4> > it would make it harder to import changes from OpenSSL

When it's a choice between making it easier to import changes or harder to import _bugs_ , I know which one I think is more important when dealing with a security library.

<comment><USER5> I don't think you see the amount of work that would go into refactoring a project of this scale whilst keeping up with the latest patches from upstream.

<comment><USER4> I do understand the the amount of work, but that wasn't the only argument presented. It was also presented as making it harder to accept patches. Since one of the goals of LibreSSL is to start applying security best practices, and one of the reasons for its existence is the poor quality and recurrent problems with OpenSSL, keeping compatibility with OpenSSL to make it easier to accept patches should be _very_ low on the list of priorities.

Put another way, if you forked because upstream was crap, not changing because it makes it easier to accept upstream patches is a poor reason not to change something that might benefit from it.

<comment><USER6> I tend to agree, maybe with one exception. Would the end result of a LibreSSL refactor introduce more bugs than leaving the current process in place (with improvements)? It seems like we can't know the answer to that question until it happens so speaking definitively about either option becomes questionable.

<comment><USER4> Definitively, no, but the lack of of a definitive (or even _likely_ ) answer still makes the it a poor choice, if not in the sense of "wrong" than in the sense of "this is something that needs to be figured out based on your goals, and until you do choices based on this will not be grounded on fact" so it's poor in that it's not well grounded.

That said, the relatively poor history of OpenSSL and the relatively high quality of software that comes out of the OpenBSD project leads me to think I know what the likely outcome of refactoring code is in this particular scenario.

<comment><USER6> That is certainly true and perhaps another advantage exists from a refactor of LibreSSL: Finding unknown bugs in OpenSSL that may only be revealed during refactoring.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> The severity of this issue is being overplayed, some programs were returning 1 in callbacks, a lot of software in the wild interpreted it the way LibreSSL did and hence the attempt at error sanitization. There are patches out for OpenBSD 6.1, LibreSSL 2.5.4 contains the fix.

[https://www.openbsd.org/errata61.html](https://www.openbsd.org/errata61.html)

[https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.4-...](https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.4-relnotes.txt)

OpenBSD 6.1 users can now also run syspatch(8).

</comment><comment><USER8> Who uses LibreSSL on production or in their apps?

<comment><USER9> Note that it is about TLS _client_ certificates so it's not as widespread as it seems (unless you use these certs of course :) ).

<comment><USER10> EAP-TLS. Wifi authentication for many enterprises and universities.

Most of which won't be using LibreSSL, tho...

<comment><USER11> Not to mention TLS VPNs like openvpn.

</comment></comment></comment></comment><comment><USER12> Does this affect users of libtls?</comment>


Stop building "MVP", validate your business model #firstthingsfirst - <AUTHOR> http://skygatedigital.co.uk/softwarehouse/stop-building-mvp-validate-your-business-model/

<comment><AUTHOR> Would you guys agree? Can't build a good product without a right feedback from customers?</comment>


Mozilla Glow: Awesome Firefox 4 live download day map - <AUTHOR> http://glow.mozilla.org

<comment><AUTHOR> Some info about it:

* Like Firefox, it is open source! <http://github.com/potch/glow>

* Counter was started this morning at 6am PST.

* Each dot represents one download.

* Map is generated using SVG, "pings" are divs with rounded corners, country radial charts are canvas.

* The bars across the bottom shows downloads per minute.

* You can drill down to the city level, to see how many downloads from your town. (Click the bottom left circle graph)

* Created by Matthew Claypotch (<http://potch.me>) and Jeff Balogh (<http://jbalogh.me>) on the Mozilla Web Dev team.

[edit: added open source information]

<comment><USER2> Wondering where did you get that map. Caspian sea is missing.

<comment><USER3> The map was generated using continent-level shapefiles (I believe from here: <http://pubs.usgs.gov/of/2006/1187/basemaps/continents/>). We stuck with continent-level outlines because adding country boundaries would have needlessly complicated the SVG, and borders can sometimes be disputed and controversial things :)

It would have been nice to have the great lakes and caspian sea, because they're such large features but with a team of two webdevs, some things have to wait until version 2.

</comment></comment></comment><comment><USER4> If someone wants their own, realtime version of this have a look at Maptail, written in nodejs:

<https://github.com/stagas/maptail>

It's pretty gosh darned awesome.

</comment><comment><USER5> Me-thinks that IE9's much touted 2.35 million downloads on day one is not going to seem so impressive by the end of today.

<comment><USER6> FF4 passed 2.35 million downloads at 3:50pm ET.

Ofcourse, FF3 was downloaded 8 million times in the first 24 hours [0]. That record won't be broken today.

[0] <http://news.bbc.co.uk/2/hi/technology/7462900.stm>

<comment><USER7> We'll see. Keep in mind that we had about 2 million Firefox 4 RC2 users who already have the "final" version and are therefore not counted on the download map.

Also note that the map just started counting (yes, from 0) at 6am Pacific. So there's still time until tomorrow, 6am Pacific until the 24-hour count is over.

At any rate, this is not a competition ;)

(full disclosure, I work on the Mozilla webdev team).

</comment></comment></comment><comment><USER8> I made an iPhone app called Glow about a year ago that visualized "feelings" on a map in much the same way. I was working on a web-based global map as well, but got bored of the idea.

<http://glowapp.com>

<http://glowapp.com/live>

I guess Glow is an obvious name for map visualization apps.

<comment><USER9> I'm not sure if it's just me, but I was clicking through the arrows to scroll through screenshots on the front page of glowapp.com and found that two captions seemed to be mixed up:

"Use Glow to share your feelings with friends on Twitter and Facebook. Update your status and mood with a single click!" was next to a picture with stars; while,

"Rating is easy. Just drag your finger across the stars. When you let go, your feeling will be sent to the cloud." is next to a picture of sharing options.

Just a heads up.

<comment><USER8> Hey thanks! I'll fix that. Honestly I haven't done any work on the app or site since last summer. I had some pretty good adoption at first, but usage really fell off because, well, it wasn't providing enough value. Then I had a baby and my time suddenly became a lot more scarce/valuable.

</comment></comment></comment><comment><USER10> Reminds me of <https://secure.logmein.com/welcome/visualization/fullscreen> (try moving the mouse around).

</comment><comment><USER11> The locations names in Israel are phonetic translations and not their English names (e.g. Yerushalayim translates to Jerusalem) wonder how they got it?

<comment><USER12> The names of regions and cities come directly from MaxMind[1], our GeoIP service. Some of our localizers provided localized names to replace the phonetic translations, so Russia, France, and Ireland see the real city names.

All of our localization is done by volunteers, so please feel free to contact me if you'd like to get involved.

[1]: <http://www.maxmind.com/app/fips10_4>

</comment></comment><comment><USER13> I would have really like an overlay with the current timezones, its quite interesting seeing most of the activity in europe and the east coast

impressive nonetheless

</comment><comment><USER14> This is quite a map/page. It reminds me the ApplemApp wall that was installed at WWDC a couple years ago where you were seeing -kind of- real time the downloaded apps from the AppStore, except they were not showing on a world map. Anyway this FF4 page is in a way a cool dashboard !

</comment><comment><USER5> So have been watching this on and off today and it's neat to watch the main concentration of downloads move with the morning hours across the map. Right now it's in Europe as everyone goes through their morning "Oh look! FF 4 released!"

</comment><comment><USER15> Doesn't look like its working for me on Latest Chrome 10, Win 7. No dots :(

<comment><USER16> Chrome 10 on OS X here, working perfectly.

<comment><AUTHOR> jedsmith: Since it's so resource intensive, it rate limits when not focused in order to not waste your CPU.

<comment><USER17> Fair enough, but it did not resume normally when I gave it focus again.

</comment></comment></comment></comment><comment><USER18> Neat, although it would be interesting to see the effect of having dots persist for more than one refresh, and perhaps fade over a few secs. I think it would look much smoother. Nice job though!

</comment><comment><USER4> Would be good if I could see the advance of sunrise overlaid on the map.

Nice work!

</comment><comment><USER19> This reminds me of the node.js knockout landing page. I _believe_ there was a map on that one. Unfortunately, I can't seem to dig up that page anymore.

</comment><comment><USER20> if you look at NY state, you will see that the town Alfred has 86000 downnloads and a city as big as new york has 10000 downloads(1/8th)... I wonder if anybody can explain that?

Point to also consider is Alfred is a town with less than 10000 people and New York city has millions!

<comment><USER21> Not only does Alfred, NY reportedly have more downloads than any other city in the world, or any other state in the US, but it currently has more downloads than any _country_ other than Germany and the US!

I think this has got to be a bug of some kind. Any explanations?

<comment><USER22> There are a couple of universities in town. Maybe somebody's mirroring script went crazy.

<comment><USER12> The logs showed all the downloads in Alfred were from curl. They've been removed from our stats.

</comment></comment></comment></comment><comment><USER23> Looking at Japan you can estimate where it was hit by the tsunami because of the lack of pings.

</comment><comment><USER24> The Netherlands density of downloads is pretty impressive. Can't find Malta though.

</comment><comment><USER25> Try resizing your browser and see why one should be careful with CSS Shadows.

</comment><comment><USER26> i have a question. i was looking at the continent/country breakdown the download counts and i didn't see iran. did no one download from iran?

<comment><USER27> Here's why: <http://news.ycombinator.com/item?id=2356480>

</comment></comment><comment><USER28> Looks like it's more popular in Europe than the US.

<comment><USER29> Looks like people are awake in Europe and starting to wake up in the US.

</comment></comment><comment><USER30> Try opening it with Chrome (seriously)

<comment><USER31> Works perfectly, right?

<comment><USER32> Works, but kind of sluggish by comparison. (Odd that I'd find myself saying that about Chrome and Firefox!)

<comment><USER12> We worked hard to make it fast in Chrome. Their profiling tools were great at finding some bottlenecks that improved perf in all browsers.

My guess is that we're pushing up against the limits of Chrome's repaint rate when the map canvas starts cranking. That's not as much of a bottleneck in Firefox since there's not a separate rendering process.

</comment></comment></comment></comment><comment><USER33> I should mention that under the hood, the live stream processing of download events is being done by SQLstream, the startup I work at. :-)

<comment><USER33> Here's a blog post by Daniel Einspanjer from Mozilla describing how the internals of this app work: [http://blog.mozilla.com/data/2011/03/22/how-glow- mozilla-org...](http://blog.mozilla.com/data/2011/03/22/how-glow-mozilla-org- gets-its-data/)

</comment></comment><comment><USER34> No one seems to be interested in Africa and Australia.

<comment><USER35> In Australia it might have something to do with the fact it's currently 3:35 am

<comment><USER36> Well, its not 3:35 anymore! Australia and NZ are definately not listed under asia which would be the logical place. This is very anoying, as I would really like to see how FF4 uptake is going over here.

<comment><USER37> Those countries are in Oceania

</comment></comment></comment></comment><comment><USER38> Nice map. ;-) Anyway, when Chrome and IE9 both seems to surpass Firefox, do you guys think this browser still have a future?

<comment><USER39> Firefox is much more viable of a browser now that the Mozilla team has addressed memory and performance issues, additionally the new "Firefox button" view gives the browser the slim and minimal look that brought many to Chrome in the first place. I've been using Chrome as my main browser for over a year and I have to say, Chrome's still got issues (i.e. excessive memory use, instability/slowdown sometimes due to orphaned processes). As for IE9, well it won't run on XP, but I haven't used it myself so I can't list any further problems it has, but I'm willing to bet a few exist.

I guess the point is, no one browser is perfect and until that point is reached any serious offering will definitely have a future.

<comment><USER17> > Chrome's still got issues (i.e. excessive memory use, instability/slowdown > sometimes due to orphaned processes)

Not to ignite a browser war, since I use and like both (and there's no point bickering about it), but:

I've had my copy of Chrome dev channel, which you'd expect to be a little less stable, open for about a week and I have under 300 MB committed (total) with 7 tabs open. I've closed a few, but here's what I mean:

<http://dropbox.jedsmith.org/hn/activity.png>

<http://dropbox.jedsmith.org/hn/browser.png>

Whenever I pitch Chrome to Firefox diehards, I always get the instability argument like you're presenting. I've used Chrome as my primary browser since about v3 when my desktop was still Windows, and the instability has largely disappeared in the last year or so. I wish I could see evidence of the issues that you and others describe, but it just doesn't happen to me on OS X and Linux any more. I haven't had a sad tab or a browser crash in _months_. And I develop in it!

What's different between you and me? I feel left out from the instability.

<comment><USER40> Chrome (64-bit Ubuntu) is currently eating 934 GB with three tabs after being open just under five hours. It's been a big enough problem for me that I bit the bullet and upgraded my desktop to 8GB (to be fair, I was sort of looking for an excuse). Flash is more stable under Firefox, but... Flash will bring down Firefox occasionally. Flash doesn't bring down Chrome, but it also just about never works. On the other hand, Flash can burn in hell for all I care.

<comment><USER41> It's chewing up almost a terabyte of memory?

<comment><USER40> Whoops, s/GB/MB/</comment></comment></comment></comment></comment></comment>


Canceling Student Debt Is Easier Than It Sounds - <AUTHOR> https://www.npr.org/2020/01/14/796329598/cancelling-student-debt-is-easier-than-it-sounds <comment><USER2> Or: students could view the selection of a college with responsibility and perform cost/benefit analysis on the institution and degree program they want to pursue so that they can pay their own debts. I'm fine with arguing whether college should be free to qualified applicants based on talent or background but I am firmly opposed to absolving people of $100k of debt because it didn't occur to them until AFTER graduation that a degree in Art History from a state college won't get them far. I chose a boring degree from a smaller school and worked my tail off during college to land internships so I was attractive to employers -- and I paid off my debts. Restructure debts? Sure. Allow all or a portion of one's student loan debt to be written off in bankruptcy? Sure. But absolve debt without any corresponding obligation on the part of borrowers who made bad choices? Hell no!

</comment><comment><USER3> Canceling student debt means increasing everyone's debt -- the national debt. It amounts to the president appropriating hundreds of billions of dollars, without congressional approval. That is not supposed to happen.

Why should people repay federal student loans in the future if they think they will be discharged?

<comment><USER2> And for people who paid their $50,000 student loans: do we get a one time, retroactive debt forgiveness payout?</comment></comment>


Skeleton: A Beautiful Boilerplate for Responsive, Mobile-Friendly Development - <AUTHOR> http://www.getskeleton.com/

<comment><USER2> I don't like it too much. It's still based on designing for desktop first.

I prefer the ones that use a mobile first approach, which is more future-proof and is supported on more devices.

Also, another thing to consider is fluid-width vs fixed-width. Fluid width layouts are harder, but much more future proof. The mobile device landscape changes fast, and there are lots of sizes to design for. A fluid-width website would be much better in this case.

Some of these are Gridless[1], HTML5 Boilerplate[2] and 320 and Up[3].

[1]: <http://thatcoolguy.github.com/gridless-boilerplate/>

[2]: <http://html5boilerplate.com/>

[3]: <http://stuffandnonsense.co.uk/projects/320andup/>

<comment><USER3> I know that you already have HTML5 Boilerplate linked, but it should be noted that there's a separate boilerplate page for mobile (<http://html5boilerplate.com/mobile/>).

</comment></comment><comment><USER4> Hey All,

This is @dhg (creator of Skeleton)and just wanted to say I was pumped to see it on Hacker News. All feedback is well received and I'm actually in the process of releasing an update that will remedy the text-resize issue when font-size is bumped up or down, along with some other small bug fixes.

In terms of fluid vs. fixed I chose to have a set number of fixed resolutions because it allows for a bit more control at those sizes and has a set of associated media query sizes . It also allows for a nested grid which is not really achievable with a fluid grid.

Thanks for the feedback again everyone. I just started a new job that is keeping me busy (in an awesome way), but am going to try to get out an update next weekend.

Cheers!

</comment><comment><USER5> How should one solve the menu issue for mobile devices? When the device is mobile, the menu on the left disappears with Skeleton. If one displays the menu, the user has to face it for every page.

Take a look at <http://isit2013.org/> to see what I'm talking about, a page I made last year (it uses media queries, but not Skeleton). I'm open to any ideas on improving this site.

</comment><comment><USER6> I've used this a number of times already and it's made rapid deployment of pages a breeze. It's used on my little sandbox site, Rawr: <http://rawr.mschade.me/>

@dhg (the creator) seems quite nice and responsive to people tweeting him about it as well, which is a definite plus.

</comment><comment><USER7> I would prefer a fluid grid. The fixed grid of Skeleton even overflows at certain device widths. I featured it on <http://mediaqueri.es/ske/> a few months ago.

</comment><comment><USER8> I despise frameworks like this. They cater to a crowd that I don't believe exists. Who goes and wants to just toss together a mobile-friendly site but doesn't have the skill set to do it without a framework like this? The huge companies that do this rather write their own and the little guys generally have hackers who can write something more efficient. The simplicity of HTML and CSS make frameworks for it seem rather silly.

Edit: That is, of course, unless it's something like YAML or SASS or LESS which completely redefine how to write the code.

<comment><USER9> You're coming from a context of businesses and startups, but perhaps it's most useful to solo developers.

Isn't the appeal that Skeleton and its ilk simply do the pixel-figuring for you? I similarly have the skillset to make a CSS grid, but I chose to wrap Nicole Sullivan's 20-line grid code in a gem just so I can brainlessly include grid functionality without even touching a CSS file.

It's projects like these that help expose people like me to bare-bones implementations upon which to build.

</comment></comment><comment><USER10> I actually just used this as the base for a project I'm working on. It is nice just to have a starting point design-wise so I don't get caught up wasting time styling when my strong suit is coding.

</comment><comment><USER11> Nitpick: the text size on the button is smaller than the default text size. I find this on a lot of CSS frameworks and think it's wrong, it's an action, should be at least the same as the default text size, if not bigger.

</comment><comment><USER9> Love the scaling. Especially how the grid becomes stacked at mobile-width.

<comment><USER12> I'm not sure what you mean by "scaling". Just because it uses a media query to serve a different style based on the screen size doesn't mean it "scales well".

In particular, this reacts quite badly to zooming, either in a desktop browser (chrome/linux): <http://imgur.com/r1z9W> or in a mobile browser (android): <http://imgur.com/7aP39> .

In the desktop case, the font size doesn't change even if I zoom in the entire page. This isn't the default behavior, so the author must have gone to some lengths to break this functionality. I'm sure s/he had reasons for doing that, but I'm not sure what they were.

In the mobile case, zooming is constrained to a very limited range, and even when allowed, the text doesn't reflow, so it's hard to read lines because of all of the horizontal scrolling required. This behavior is quite common for fixed width, "grid" layouts.

In general, I'm all for frameworks that solve common layout problems, but this particular framework seems to have gotten the basics wrong. I would recommend against using it as it stands.

<comment><USER9> Thanks for the explanation. I don't own a smartphone or have experience with media queries, so this was one of my first times seeing media queries in action and I'm easily impressed.

By "love the scaling", I guess I meant "I love media queries."

</comment></comment></comment><comment><USER13> It's really great to see open-source resources like this emerging all the time, as opposed to the likes of Flash. CSS, HTML5, and JS were all pushed pretty hard at a mobile hackathon I went to today.

</comment><comment><USER14> Looks neat thanks. I tried Less Framework a while back and for some reason, just didn't quite get on with it...so it's nice to have an alternative

</comment><comment><USER15> How does it compare with Less Framework(<http://lessframework.com/>) ?

</comment><comment><USER16> I'm giving my personal recommendation for this. It's cut my front-end development times extensively.

</comment><comment><USER17> Am in the process of planning a redesign of a site, looking forward to working with this.

</comment><comment><USER18> Can definitely see myself using this with jQuery Mobile. Thanks.

<comment><USER19> But that makes no sense? jQuery Mobile already does responsive layouts?

</comment></comment><comment><USER20> Skeleton first got my attention a few weeks ago when I noticed Paul Irish had forked it to his Github account.

<https://github.com/paulirish/Skeleton>

</comment><comment><USER21> So <http://www.getskeleton.com/> or <http://html5boilerplate.com/> ?

Fight!

</comment><comment><USER22> How does it compare to Less? <http://lessframework.com/>

<comment><USER16> Can't speak for anyone else, but I've found it easier to integrate with my pre-existing layout.

EDIT: I was referring to Skeleton, btw

</comment></comment><comment><USER23> I like what I see here. Will try to use it in my next project.

</comment><comment><USER24> Been using this a lot lately, really love it thanks @dhg

</comment><comment><USER25> Very cool. I'm just sad that it is limited to 960px :/.</comment>


Patrick Freyne's big regret? Having a healthy work-life balance /s - <AUTHOR> http://www.irishtimes.com/life-and-style/people/patrick-freyne-s-big-regret-having-a-healthy-work-life-balance-1.2731422 <comment><AUTHOR> My local parish rag has started writing these click-bait articles to troll their online readership. This one is actually quite funny, and a comment elsewhere on HN about work-life balance prompted me to post it. I particularly enjoyed the phrases _" cry-typing"_ and _" galumphing [my lunch] down in a petrol station forecourt before cry-driving to an assignment"_ \- he paints quite the picture :D</comment>


Bitcoin Roundtable Consensus - <AUTHOR> https://medium.com/@bitcoinroundtable/bitcoin-roundtable-consensus-266d475a61ff <comment><USER2> Good to see the community is working through the technical (and political challenges) for the future of bitcoin.

At the same time, the level of technical jargon being batted around highlights how far bitcoin is from being money.

Look at the first point of agreement. As long as "SegWit forks" are still important news for Bitcoin, it will not be money.

"We understand that SegWit continues to be developed actively as a soft-fork and is likely to proceed towards release over the next two months, as originally scheduled."</comment>


A history of adventure games, and how interfaces affect puzzles - <AUTHOR> http://www.strangehorizons.com/2008/20080804/newheiser-a.shtml

<comment><USER2> Interesting, but why did the author restrict the discussion to PC games? I would expect to see some mention of Portal's interface, and of adventure games for the Wii.

<comment><AUTHOR> Author here! I enjoyed Zack and Wiki on the Wii, and some of the adventure game titles on the DS like Phoenix Wright, Professor Layton, and I've referenced some of those in my other writings about adventure games. My main reason for focusing on PC games and older titles was that that seemed to be where the majority of interface evolution and changes took place. Zack and Wiki is an entertaining concept, but the interface is primarily point and click with some supplementary controls using the motion sensing of the controller and all the buttons the wiimote allows for... similarly with the DS adventure titles, it treats the touch screen as a point and tap world.

As for portal, drawing the lines between adventure games and other genres can be fuzzy. Bringing games into real-time 3D is a much more significant shift than bringing a game from a text adventure to a graphic adventure. While there are definitely many types of games which involve puzzles, I prefer to define Adventure Games as being based around solving abstract puzzles that aren't dependent upon a real-time engine.</comment></comment>


Ask HN: Rails development on the iPad - <AUTHOR>

Hi all,
I'm wondering what the state of developing RoR apps from an iPad is? I picked up a copy of Textastic, but would like to know what other tools are recommended.
Cheers. <comment><USER2> I think this will help you move to the right track.

How a Macbook was replaced by an iPad+Linode combo

[http://yieldthought.com/post/12239282034/swapped-my- macbook-...](http://yieldthought.com/post/12239282034/swapped-my-macbook-for- an-ipad)

</comment><comment><USER3> I keep seeing posts like this, especially "how to use your tablet like a PC" or "how to run Windows on your tablet". Just buy a computer! It's not as sexy but you'll be more productive :-)

<comment><AUTHOR> Already have a MacBook and an iMac which I use everyday. My question was not about productivity, more about curiosity.

<comment><USER3> Ah, apologies for jumping to conclusions :-)

</comment></comment></comment><comment><USER4> Sorry to say that, but use the right tool for the job. Some kind of PC with Linux or OSX on it.

<comment><AUTHOR> Yep I'm a rails dev so I understand what are the right tools, but that doesn't answer my question.</comment></comment>


Ello, Ello? New 'No Ads' Social Network Ello Is Blowing Up Right Now - <AUTHOR> http://techcrunch.com/2014/09/25/ello-ello-new-no-ads-social-network-ello-is-blowing-up-right-now/

<comment><USER2> "Blowing up". really? Based on the actual article content I would have said taking off, ascending, something meant to convey that Ello is seeing more users and more prospects. "Blowing up" is, at the very least, ambiguous in its meaning.

<comment><USER3> > "... as of today most of your friends will be asking their other friends how > to get an invite to the invite-only network to secure their coveted user > name."

This reads like an Onion article.

<comment><USER2> Not to disparage those sincere writers over at Onion. :)</comment></comment></comment>


The unsexy IoT - <AUTHOR> http://deepstream.io/blog/the-unsexy-iot/ <comment><USER3> IoT has many other problems... as pointed out by the popular twitter account against it: [https://twitter.com/internetofshit?lang=en](https://twitter.com/internetofshit?lang=en)

Some of the most amusing posts:

\- Nest not being able to function while there is service outage (e.g. can't change temperature if server is down) [https://twitter.com/Jenthulhu/status/688918036791840768](https://twitter.com/Jenthulhu/status/688918036791840768)

\- Tried to install an Spotify update for the car, ended disabling brakes. [https://twitter.com/internetofshit/status/687693238103224320](https://twitter.com/internetofshit/status/687693238103224320)

\- Extortion by your own appliances (in-app-purchases + IoT, parody?): [https://twitter.com/internetofshit/status/633278514284920833...](https://twitter.com/internetofshit/status/633278514284920833/photo/1)

\- Samsumg smart fridge exposes your Google credentials: [https://twitter.com/internetofshit/status/636102318585475072...](https://twitter.com/internetofshit/status/636102318585475072/photo/1)

\- Can't change thermostat while updating: [https://twitter.com/internetofshit/status/684831858463387648...](https://twitter.com/internetofshit/status/684831858463387648/photo/1)

\- Mall smart screens get blue screen of death: [https://twitter.com/internetofshit/status/652403071859970048](https://twitter.com/internetofshit/status/652403071859970048)

<comment><USER4> "The internet has many other problems. Just a few days ago, Dropbox was down."

<comment><USER5> The solution is federated, P2P-like systems. But, unfortunately, there is no money to be made with such solutions.

<comment><USER6> No one's making money of BitTorrent, and yet it functions. I think that P2P Dropbox or even youtube (without ads) is a pretty good idea.

<comment><USER5> You are completely right, those are very good ideas... except if you want to make some money with your coding efforts.

The sad thing is, these days you only seem to be able to make money by holding your customers hostage in your online systems (cloud) or ecosystems. I miss the days where developers could make money selling just software.

</comment></comment></comment></comment></comment><comment><USER7> I work for a company doing unsexy IoT and I've been dreaming about writing this article for months now. We're a tiny company in New Jersey whose been around in some form or another for the last 25 years, supplying remote telemetry units (RTUs) to the industrial assets industry. Helium, oxygen, nitrogen, whatever, on boats, trucks, and static sites. We also provide a monitoring platform which is where I come in. We're a very uncool Apple - vertically integrated, we design, build, manufacture, ship, and program all of our RTUs in-house. IoT has been around for a long long time now - a lot of our work comes from clients who can't maintain their old systems anymore.

The entire hype wave of IoT has more or less passed right over us. Nobody has heard our name, save for the gas industry itself. But that industry is about to (not literally) explode. Helium is an extremely lucrative industry and is growing by the minute, and there's really nobody in this space but us. Remote monitoring - IoT - has never been more critical to helium than it has now. Without going into too much detail, knowing the pressure levels of your tank 24/7 can save you _a lot_ of money.

So where do I come in? Our platform is written in C#, with the front-end done in Silverlight. I'm the dude getting us off it with some really hip JS work in React. Before that I wrote a lot of microservices to handle various aspects of our system. We were in a pretty bad state when I got there so I spent a lot of time improving our development team. We didn't have PRs for a long time. For a first job out of college, it's not bad. I get to do a lot of cool work, and on my current project I've made every technical decision. But sometimes I wish that we could attract better talent. Oh well, I'm (hopefully) leaving soon.

<comment><USER8> C#? Quite interesting.

Anything that you can share about it?

The language geek in me loves the use of C#, Java and similar safe stacks in the IoT domain. :)

<comment><USER7> We don't program the boards in C#, just the services/Silverlight. The communication methods between the boards is well abstracted - most of our devices are reached via phone number. They have a SIM card with a carrier and services essentially make a phone call to get the data. There's a lot to do with communication protocols (i.e. bytes 0-8 are the configuration, 9-12 readings, etc.) but .NET has nice support for binary constructs. Some RTUs are difficult to work with because they have conversations with our server, and the lifetime of that call must be maintained while a million other things are going on.

I wasn't here when the C# decision was made, but it's worked out really well for us so far, Silverlight notwithstanding. Microservices work out really well for us too because there's a lot of code written for specific RTUs which will not (and should not) be shared, and having them explicitly separated keeps everything tidy. Microservices communicate via a centralized publisher using WCF, which uses MSMQ as the underlying transport method. Our #1 priority is to never loose data so these technologies are a pretty safe bet. Like I mentioned before, C# has good support for low-level stuff, but we don't do as much low- level as you think. Our greatest challenge is handling several distinct protocols with as much as the same code path as possible, and C# has really great generics support which makes our lives easy. We don't require the performance a C++ platform would bring.

To elaborate a bit more, our basic control flow goes something like:

Poll unit -> get data -> push data -> translate data -> assign data to business objects -> operate on data -> present data

Each step usually involves a save to the database of critical info at that stage.

<comment><USER8> Thanks for sharing.

I am currently aware of stuff using .NET CF, the old WinCE/Pocket PC stack or just doing straight IO control from the PC side to "dumb" firmware that just follows the given commands.

</comment></comment></comment></comment><comment><USER9> > There is, however, enormous opportunity in crossing this chasm. The new IoT > provides valuable data about its users, their habits, daily routines and > preferences. The old IoT generates detailed information about the > environment they interact in. Combining both with big data crunching > technology will lead to unprecedented (and slightly scary) insights into > individual user's behavioral patterns as well as into the systems they > compose.

And this is the gap that I don't want to be bridged. One of the reasons I love my rpi's, is that I end up with ultimate control over my device and it's data. At the end of the day, I decide what leaves my home, not $smart_company. If I decide to submit that data to them, sure, they can run with it, but if they require me to send it? I'm not even going to consider their product.

The data-crunching would also have to be done on my server, or I'm not interested. Yes, I understand that my home-server is probably not powerful enough to do the processing required, but I'll live without whatever feature requires it.

<comment><USER4> I wrote a library to enable secure communications over insecure channels for IoT, maybe it'll be useful to you: [https://stringphone.readthedocs.org/en/latest/](https://stringphone.readthedocs.org/en/latest/)

<comment><USER9> Interesting. I actually run a web-server, and I only control my stuff through a web-API's, but that could also be useful....

Thanks

<comment><USER4> It doesn't really matter how you get messages to clients, the library just makes sure that each participant is who they say they are. For example, a rogue client could connect to your API and start sending commands, but with this library, they'd have to know the key.

That said, it's definitely not useful everywhere, e.g. if you use TLS and the application is only for stuff at home, you're probably fine.

</comment></comment></comment></comment><comment><USER10> My view with IoT is that is true value lies in the monitoring and data collection aspect, and the analysis and prediction that it enables. Consumer IoT doesn't value from this - consumer IoT is all about having Bluetooth and smartphone apps for your foobar gadget.

Industrial IoT is where the value is - and it's been around for years. Airlines and manufacturers like Boeing and Airbus have streams of data from planes all over the world that allow them to pick trends, predict failures, and take preemptive action. Agriculture use IoT to take real-time measurements across their entire farms without spending hours driving, and get their robotic tractors to go respond with water/fertilizer/pest control. Consumer IoT isn't in a position to get these 'aggregate' benefits.

<comment><USER11> I don't think there are any valid use cases for a widely distributed network of any kind of personal item that make sense for consumers. Consumers don't continuously manage large repetitive processes. They don't own items that remain distributed, or are being redistributed on any regular basis. They simply don't have the minimum threshold of Things that would benefit from the Internet.

<comment><USER12> I don't know what qualifies as "large" but procuring food for my family is a tedious and time-consuming task so for me at least it is large and repetitive. I'm not sure how much that can be automated though.

The parent post mentioned tracking of airplanes. I wouldn't mind if a company monitored my home heating system or refrigerator and notified me if they were about to fail, as these failures can be expensive and a huge hassle if not anticipated. Also consumers already benefit from alarm systems and cameras they can monitor remotely. Heck, alarm systems have been centrally monitored for decades, just over proprietary networks rather than the Internet.

<comment><USER13> _I wouldn 't mind if a company monitored my home heating system or refrigerator and notified me if they were about to fail, as these failures can be expensive_

I'd be worried that the pre-emptive maintenance would be far more expensive. You can already get heating system insurance, but I wouldn't trust the IoT system to not over-order maintenance in order to maintain the company's profits.

I saw an advert for HP's printer ink subscription service: [http://www8.hp.com/uk/en/ads/instant- ink/overview.html](http://www8.hp.com/uk/en/ads/instant-ink/overview.html) and recoiled in horror. It's already the most expensive liquid most people will buy, and you want to let the printer order it for you?

We're back to the door in Ubik that asked the user for a nickel before it would open every time.

<comment><USER14> Indeed. I'd be totally for such a system, but as a _product_ , not a _service_. Some things really should _not_ be managed by third parties - <USER2> sadly, our economy is moving towards exactly that.

</comment></comment></comment></comment></comment><comment><USER15> I totally echo the OP (Disclaimer: I work at a big data analytics SaaS with IoT customers called Treasure Data).

The "unsexy" IoT can be really unsexy. One customer wanted to get their data out of SCADA (www.scada.com), and as it turns out, the only way to get telemetry data out of their SCADA boxes was through emails as CSV attachments.

We ended up working with a third party dev shop to build a simple mail server that parses the incoming CSVs and send them to our backend so that the vendor could analyze the data coming from SCADA (which in turn came from heavy industry devices) using SQL, Salesforce, etc.

I never thought that MIME attachments would be a critical part in a "big data", "IoT" analytics pipeline...

<comment><USER16> Beauty is in the eye of the beholder.

SMTP has its own advantages over HTTP in M2M/IoT space, both in terms of simplicity and robustness. Sure, it's not as tightly coupled or feature rich as a web API, but that might not be such a bad thing.

</comment></comment><comment><USER14> > _The new IoT provides valuable data about its users, their habits, daily > routines and preferences._

Herein lies the problem. IoT should _not_ provide that data to the third parties.

Also this:

> _We have become more comfortable with sharing personal data, e.g. when it > comes to incorporating wearables or fitness trackers into our daily > routine._

That those are the only reasonable examples one could come with only shows that the "sexy" IoT is just a bunch of bullshit, overpriced toys that are only meant to monetize people's data even more. This trend should be nipped in the bud.

RE "unsexy" IoT, the article says:

> _It is now almost completely based on open protocols, rather than the > proprietary ones of the past that were used to tie customers to a specific > vendor._

I didn't know that. Somehow I was led to believe all those protocols are closed and licensed, requiring you to join some "consortium" or "alliance", paying a $shitton entry/licensing fee. I'll look into it. If there are established open, working standards out there, then it's what I want to use in my DIY IoT / home automation solutions.

EDIT:

> _(...) into your app._

That's _another_ problem. Our obsession with apps. This is something that really needs to be culled too. One of the biggest factor that makes the "sexy IoT" barely usable is that every device has its own app. Which means, every company gets to develop a shit UI (each crappy in different way), and the time it takes to switch between apps is several seconds. This should all be standardized - I should have just _one_ app for all my IoT, and it definitely must _not_ be made by one of the vendors (for the same reason nobody uses software provided by e.g. printer vendors).

<comment><USER17> > Herein lies the problem. IoT should not provide that data to the third > parties.

To an extent, maybe. There's tremendous value in this space for all kinds of things. The canonical example from Bill Joy's time is a fridge that predicts your eating habits and keeps you stocked with the items you need for dinner via automated delivery services.

> overpriced toys that are only meant to monetize people's data even more. > This trend should be nipped in the bud.

"The internet is just a fad."

> I was led to believe all those protocols are closed and licensed, requiring > you to join some "consortium" or "alliance", paying a $shitton > entry/licensing fee.

There are plenty. This is one of the ones I'm familiar with: [http://github.com/spark](http://github.com/spark)

> That's another problem. Our obsession with apps.

I think that even apps will be marginalized over time. People generally don't want to interact directly with software/technology at all. They want it to "just work" ala Google search. The best "IoT" devices will seamlessly augment existing interfaces and technologies instead of inventing new ones.

<comment><USER14> > _The canonical example from Bill Joy 's time is a fridge that predicts your > eating habits and keeps you stocked with the items you need for dinner via > automated delivery services._

Yes, but in this canonical example the prediction could, and IMO should, be entirely done client-side; only actual food orders would be done on-line.

> _There are plenty. This is one of the ones I 'm familiar with: > [http://github.com/spark*](http://github.com/spark*)

Thanks! Though this still looks like the "sexy IoT" generation protocol; I was wondering about the article's assertion that "unsexy IoT" is now based on open protocols.

</comment></comment></comment><comment><USER18> We see a lot of both sides of this at BR ([http://buildingrobotics.com/](http://buildingrobotics.com/)) -- we are actually BACnet experts, but also provide a really novel user experience on top of this legacy protocol. One thing I'd add is that many of the "legacy" industries have evolved in a way that's very different from what the Internet crowd expects and so you can't always make the same assumptions.

Also, it might be "unsexy" but buildings consume 70-ish percent of US electricity, a lot of which is controlled by BACnet and friends... and it turns out there's a ton of low-hanging fruit that's only a (carefully crafted, ASN.1-ish) UDP packet away..

</comment><comment><USER19> > IPv6 has massively increased the number of available IPs, > allowing every > sensor and relay within a system to be > addressable from the public > internet

... which, while necessary for the IoT dream, is a very very very dangerous thing.

Another downside of an upside is the idea of over-the-net updatable firmware for all devices in your house. The unfortunate flipside of easily-updated-by- the-vendor software is that the initial software will not be fully tested--"we can fix any 'little' bugs later"\--and future releases will also not be adequately tested. Not to mention the glaring security hole when your entire house is run by devices and sensors that can be updated remotely.

It's going to get messy...

</comment><comment><USER20> > IPv6 has massively increased the number of available IPs, allowing every > sensor and relay within a system to be addressable from the public internet

That's a really scary idea from the security point of view and something that bothers me about the IoT craze. Every consumer device visible on the Internet should quickly and reliably self-update its software if a security issue is found and remote updates are still a bit tricky to implement in embedded devices (little storage, diverse hardware).

<comment><USER4> Firewalling them is probably a better idea. For most applications, connecting to a central server/hub that's better secured is just fine.

</comment></comment><comment><USER21> Fully agree: most of the IoT solutions are "unsexy" stuff.

It's often painfully hard to explain that the kickstarter-sexy projects are only the tip of the iceberg.

A BLE "smart" waffle machine would surely be fun, and good material for @internetofshit. But while we're looking at useless/gadgets stuff, there are a LOT of useful (or at least midly interesting) things happening in the IoT.

Unsexy doesn't mean old. And IoT doesn't mean "smart device". A dumb sensor sending raw data can bring in a lot of valuable data.

Metering is still a thing, and i see new projects every week in various fields : agriculture, public equipments, healthcare, safety, ... Lot of independent things that don't need to be used by a user, and that you don't especially know they are "connected"

</comment><comment><USER8> Also regarding unsexy IoT, despite having been replaced by Android Java fork in the mobiles space, J2ME and Embedded Java are being used by quite a few companies in the unsexy IoT space.</comment>


Access your Event timelines and OAuth tokens through the API - GitHub - <AUTHOR> https://github.com/blog/977-access-your-event-timelines-and-oauth-tokens-through-the-api <comment><USER2> Sweet. It's about time there is token support for the API.</comment>


GitHub attacked again as Chinese developers forced by police to pull code - <AUTHOR> http://arstechnica.com/security/2015/08/github-attacked-again-as-chinese-developers-forced-to-pull-code-by-police/

<comment><USER2> Resistance is futile, it will be forked.</comment>


Spam Comment Generator Script - <AUTHOR> http://alexking.org/blog/2013/12/22/spam-comment-generator-script <comment><USER2> If you want to learn more, this formatting is called "spintax" and is supported by a lot of the blackhat SEO tools.

[0] [http://en.wikipedia.org/wiki/Article_spinning](http://en.wikipedia.org/wiki/Article_spinning)

<comment><USER3> It's supported by all blackhat tools used for posting.

</comment></comment><comment><USER4> Not the first time someone's slipped up [1].

[1] [http://www.hanselman.com/blog/ExposedABlogCommentSpammersSou...](http://www.hanselman.com/blog/ExposedABlogCommentSpammersSourceTemplate.aspx)

</comment><comment><USER3> Just plain old article spinning; format looks like its meant for Scrapebox.

This is some pretty noobish stuff. A more effective way to decrease moderation is to make comments talking about how you enjoyed the article and linked to their blog. You then setup a script on your site to detect referral traffic from /wp-admin, etc., pull the rss feed for their site and then inject their latest blog post in the page content/side bar (e.g. Recommended Reading!). Drop an evercookie so it shows up if they come back.

</comment><comment><USER5> I'm more concerned at the long vertical rows of spaces and |'s. How does that happen by chance?

<comment><USER6> Might be the pattern writer having some fun? Given the braces and bars, they wouldn't even result in any patterns in the output.

</comment></comment><comment><USER7> So how come most of the lines don't have a link to their website? I mean most of the lines congratulate the author for their excellent blog post.. Is that really spam?

<comment><USER8> Typically they'll submit links in the "Link" or "Name" field.

But as you say the majority of spam submissions will actually include a link in the body of the comment too.

(Actually many comments include the link with numerous variations: BBCode, HTML, and even Markdown formatted. As a heuristic it is easy to write off spam that uses three or more different linking stratagies - I do that in my blog- spam detection service @ [http://blogspam.net/](http://blogspam.net/) )

<comment><USER7> I see what you did there ;-) But thanks for the explanation

<comment><USER9> spammed this post about spam with his anti-spam service?

edit: wordpress plugin looks perfect for a few of my blogs

</comment></comment></comment></comment><comment><USER10> The links are sent in the URL field, not in the comment contents.

<comment><USER11> Is there a good plugin for wordpress that just deletes any post coming in with URL fields? I don't have interface for the URL field in my blog, so any comment submitting one is always coming from a spam script.

<comment><USER8> I'm not familiar with such a plugin, but for a small donation I'm sure myself/others reading here could write it for you :)

 __UPDATE __: I 've written the trivial plugin, but only tested it a little: [https://github.com/skx/wordpress-no-links](https://github.com/skx/wordpress- no-links)

<comment><USER11> Wow, thanks! :)

</comment></comment></comment></comment><comment><USER12> Why do spammers continue to do this? Since the panda / penguin updates, I presumed Google no longer counted links from blog comments, even if they were do-follow links.

</comment><comment><USER13> On the other hand, you now have something that could easily be turned into a regex for detecting spam.

<comment><USER14> You can't process a context-free grammar with a DFA.</comment></comment>


Show HN: BinCDN - <AUTHOR> https://bincdn.com <comment><USER2> I built something around the same concept and decided to give up on it as the only business model that seemed to make sense entailed competing with google drive/ dropbox etc.

The idea was simple, like appear.in/[any slug you want] is a video conference room. I wanted klipped.in/[any slug you want] to be a folder or a file

Best of luck with your project! And let me know if you want [https://klipped.in](https://klipped.in) as I don't really have a use for it anymore!

<comment><AUTHOR> Thank you! I just wrote this article today about competition with Google Drive and Dropbox.. as I knew those were the biggest competitors and not two I could even beat. But I'm trying to figure out where I can at least have some advantage or even more personalization.

[https://hackernoon.com/competing-against-the-giants-as-an- al...](https://hackernoon.com/competing-against-the-giants-as-an-alternative- ce1f2b5bb681)

</comment></comment><comment><AUTHOR> BinCDN: A flash drive in the cloud: the fastest and easiest file and image service you will ever use.

Happy to release a new product today.

I've always wanted to build a file storage and sharing service. Features include mobile-friendliness, tracking geometrics on clicks, allowing for comments, password protection, ability to mask from your domain, keep notes, view mp4 & mov files in browser, as well as spreadsheet and powerpoints, unmetered bandwidth, and is on one of the fastest CDNs out there, enhanced with Cloudflare. Still somewhat of a work in progress, but 95% complete and now it's just adding some more useful features!

<comment><USER3> Routing resolution error

Error 1004 Ray ID: 46dd23834b5c3fb3 • 2018-10-22 15:53:46 UTC Routing resolution error

<comment><AUTHOR> Figures.. just as I released it, haha.

<comment><AUTHOR> Oh cloudflare.. ha.

</comment></comment></comment></comment><comment><AUTHOR> All fixed and working! :)</comment>